{"id":"GHSA-vx24-x4mv-vwr5","revision":"843112f5a1a044068dbf9b635e330430","records":[{"revision":"843112f5a1a044068dbf9b635e330430","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-vx24-x4mv-vwr5","aliases":["CVE-2024-41815","RUSTSEC-2024-0446"],"title":"Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands","description":"## Description \nStarship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.\n\n### PoC\nHave some custom command which prints out information from a potentially untrusted/unverified source.\n```\n[custom.git_commit_name]\ncommand = 'git show -s --format=\"%<(25,mtrunc)%s\"'\nstyle = \"italic\"\nwhen = true\n```\n\n### Impact\nThis issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.","state":0,"publishedAt":"2024-07-26T21:24:18+00:00","modifiedAt":"2025-12-22T16:44:26.461289+00:00","affected":[{"ecosystem":"crates.io","name":"starship","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.20.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/starship/starship/security/advisories/GHSA-vx24-x4mv-vwr5","https://nvd.nist.gov/vuln/detail/CVE-2024-41815","https://github.com/starship/starship/commit/cfc58161e0ec595db90af686ad77a73df6d44d74","https://github.com/starship/starship","https://github.com/starship/starship/releases/tag/v1.20.0","https://rustsec.org/advisories/RUSTSEC-2024-0446.html"],"sourceUrl":"https://github.com/advisories/GHSA-vx24-x4mv-vwr5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vx24-x4mv-vwr5","identifiers":["GHSA-vx24-x4mv-vwr5","CVE-2024-41815","RUSTSEC-2024-0446"]},"retained":false,"historicalAffected":[]}],"coverage":[]}